streamby-core 0.39.0 → 0.41.0

package/dist/services/mediaProcessor.js

@@ -45,7 +45,7 @@ function inferMetadata(contentType, size) {
     return meta;
 }
 async function runIngestJob(jobId, fileId, projectId) {
-    (0, jobQueue_1.updateJob)(jobId, { status: 'processing', stage: 'resolving', progress: 10 });
+    await (0, jobQueue_1.updateJob)(jobId, { status: 'processing', stage: 'resolving', progress: 10 });
     try {
         const filesCol = getFilesCollection();
         if (!filesCol)
@@ -53,7 +53,7 @@ async function runIngestJob(jobId, fileId, projectId) {
         const fileDoc = await filesCol.findOne({ fileId, projectId });
         if (!fileDoc)
             throw new Error(`File ${fileId} not found in project ${projectId}`);
-        (0, jobQueue_1.updateJob)(jobId, { stage: 'extracting-metadata', progress: 40, assetId: fileId });
+        await (0, jobQueue_1.updateJob)(jobId, { stage: 'extracting-metadata', progress: 40, assetId: fileId });
         const metaCol = getMetadataCollection();
         if (metaCol) {
             const meta = inferMetadata(fileDoc.contentType ?? '', fileDoc.size ?? 0);
@@ -67,7 +67,7 @@ async function runIngestJob(jobId, fileId, projectId) {
                 },
             }, { upsert: true });
         }
-        (0, jobQueue_1.updateJob)(jobId, { stage: 'creating-version', progress: 70 });
+        await (0, jobQueue_1.updateJob)(jobId, { stage: 'creating-version', progress: 70 });
         const versionsCol = getVersionsCollection();
         // Its upload already recorded the version it's in; only an asset from before versions
         // were kept gets one here.
@@ -85,14 +85,14 @@ async function runIngestJob(jobId, fileId, projectId) {
                 createdAt: new Date(),
             });
         }
-        (0, jobQueue_1.updateJob)(jobId, { status: 'completed', stage: 'complete', progress: 100 });
+        await (0, jobQueue_1.updateJob)(jobId, { status: 'completed', stage: 'complete', progress: 100 });
     }
     catch (err) {
-        (0, jobQueue_1.failJob)(jobId, err.message);
+        await (0, jobQueue_1.failJob)(jobId, err.message);
     }
 }
 async function runTranscodeJob(jobId, fileId, projectId, options, _adapter) {
-    (0, jobQueue_1.updateJob)(jobId, { status: 'processing', stage: 'queued', progress: 5, assetId: fileId });
+    await (0, jobQueue_1.updateJob)(jobId, { status: 'processing', stage: 'queued', progress: 5, assetId: fileId });
     try {
         const filesCol = getFilesCollection();
         if (!filesCol)
@@ -103,7 +103,7 @@ async function runTranscodeJob(jobId, fileId, projectId, options, _adapter) {
         if (!fileDoc.contentType?.startsWith('video/') && !fileDoc.contentType?.startsWith('audio/')) {
             throw new Error('Transcode only supports video and audio files');
         }
-        (0, jobQueue_1.updateJob)(jobId, { stage: 'transcoding', progress: 20 });
+        await (0, jobQueue_1.updateJob)(jobId, { stage: 'transcoding', progress: 20 });
         // Store the transcode request as a pending task — actual FFmpeg execution
         // happens in the host environment (Nhexa-API worker). The job record is the
         // handoff contract: the worker reads it, processes the file, and calls back
@@ -127,14 +127,14 @@ async function runTranscodeJob(jobId, fileId, projectId, options, _adapter) {
                 },
             }, { upsert: true });
         }
-        (0, jobQueue_1.updateJob)(jobId, { stage: 'pending-worker', progress: 30 });
+        await (0, jobQueue_1.updateJob)(jobId, { stage: 'pending-worker', progress: 30 });
     }
     catch (err) {
-        (0, jobQueue_1.failJob)(jobId, err.message);
+        await (0, jobQueue_1.failJob)(jobId, err.message);
     }
 }
 async function runThumbnailJob(jobId, fileId, projectId, options) {
-    (0, jobQueue_1.updateJob)(jobId, { status: 'processing', stage: 'resolving', progress: 10, assetId: fileId });
+    await (0, jobQueue_1.updateJob)(jobId, { status: 'processing', stage: 'resolving', progress: 10, assetId: fileId });
     try {
         const filesCol = getFilesCollection();
         if (!filesCol)
@@ -142,7 +142,7 @@ async function runThumbnailJob(jobId, fileId, projectId, options) {
         const fileDoc = await filesCol.findOne({ fileId, projectId });
         if (!fileDoc)
             throw new Error(`File ${fileId} not found`);
-        (0, jobQueue_1.updateJob)(jobId, { stage: 'pending-worker', progress: 30 });
+        await (0, jobQueue_1.updateJob)(jobId, { stage: 'pending-worker', progress: 30 });
         const metaCol = getMetadataCollection();
         if (metaCol) {
             await metaCol.updateOne({ assetId: fileId, projectId }, {
@@ -160,14 +160,14 @@ async function runThumbnailJob(jobId, fileId, projectId, options) {
                 },
             }, { upsert: true });
         }
-        (0, jobQueue_1.updateJob)(jobId, { stage: 'pending-worker', progress: 40 });
+        await (0, jobQueue_1.updateJob)(jobId, { stage: 'pending-worker', progress: 40 });
     }
     catch (err) {
-        (0, jobQueue_1.failJob)(jobId, err.message);
+        await (0, jobQueue_1.failJob)(jobId, err.message);
     }
 }
 async function runCaptionJob(jobId, fileId, projectId, options) {
-    (0, jobQueue_1.updateJob)(jobId, { status: 'processing', stage: 'resolving', progress: 10, assetId: fileId });
+    await (0, jobQueue_1.updateJob)(jobId, { status: 'processing', stage: 'resolving', progress: 10, assetId: fileId });
     try {
         const filesCol = getFilesCollection();
         if (!filesCol)
@@ -195,9 +195,9 @@ async function runCaptionJob(jobId, fileId, projectId, options) {
                 },
             }, { upsert: true });
         }
-        (0, jobQueue_1.updateJob)(jobId, { stage: 'pending-worker', progress: 30 });
+        await (0, jobQueue_1.updateJob)(jobId, { stage: 'pending-worker', progress: 30 });
     }
     catch (err) {
-        (0, jobQueue_1.failJob)(jobId, err.message);
+        await (0, jobQueue_1.failJob)(jobId, err.message);
     }
 }

package/dist/services/oauthTokens.d.ts

@@ -0,0 +1,60 @@
+import { ApiTokenScope, OAuthResourceConfig } from '../types';
+import { ApiTokenPermission } from './apiTokenPermissions';
+export declare const OAUTH_SCOPES: readonly ["streamby:read", "streamby:write"];
+export type OAuthScope = typeof OAUTH_SCOPES[number];
+/** The permissions each scope grants. */
+export declare const OAUTH_SCOPE_PERMISSIONS: Record<OAuthScope, ApiTokenPermission[]>;
+/** What a token's scopes let it do (scopes that aren't StreamBy's grant nothing here). */
+export declare const permissionsForOAuthScopes: (scopes: string[]) => ApiTokenPermission[];
+export interface Jwk {
+    kty: string;
+    kid?: string;
+    n?: string;
+    e?: string;
+    alg?: string;
+    use?: string;
+}
+export interface Jwks {
+    keys: Jwk[];
+}
+export interface OAuthTokenVerifierOptions {
+    issuer: string;
+    audiences: string[];
+    jwks: string | (() => Promise<Jwks>);
+    jwksCacheMs?: number;
+    fetcher?: (url: string, init: RequestInit) => Promise<Response>;
+    now?: () => number;
+}
+export interface VerifiedOAuthToken {
+    userId: string;
+    clientId: string;
+    scopes: string[];
+    expiresAt: Date;
+    scope: ApiTokenScope;
+}
+/**
+ * Whether a bearer is shaped as an OAuth access token (a JWT signed with RS256), not whether
+ * it's valid: for an authProvider to tell it from its own session tokens.
+ */
+export declare const looksLikeOAuthAccessToken: (token: unknown) => token is string;
+/** The grant an OAuth request counts as (its rate limit's key): one app, for one user. */
+export declare const oauthGrantId: (clientId: string, userId: string) => string;
+/**
+ * Checks OAuth access tokens: their signature with the issuer's keys, the issuer, that they're
+ * for StreamBy (their audience), and that they haven't expired. The verified token, or null.
+ * It doesn't know whether the user has since revoked the app: the host may check that too.
+ */
+export declare function createOAuthTokenVerifier(options: OAuthTokenVerifierOptions): (token: unknown) => Promise<VerifiedOAuthToken | null>;
+/** Where RFC 9728 puts a resource's metadata: at its origin, before its path. */
+export declare const defaultResourceMetadataUrl: (resource: string) => string;
+export declare const resourceMetadataUrlOf: (oauth: OAuthResourceConfig) => string;
+/** The metadata a client reads to know where to sign in, and what to ask for. */
+export declare const protectedResourceMetadata: (oauth: OAuthResourceConfig) => {
+    resource: string;
+    authorization_servers: string[];
+    scopes_supported: ("streamby:read" | "streamby:write")[];
+    bearer_methods_supported: string[];
+    resource_name: string;
+};
+/** The WWW-Authenticate challenge of a 401: the metadata's URL, and why the token was refused. */
+export declare const wwwAuthenticate: (oauth: OAuthResourceConfig, invalidToken: boolean) => string;

package/dist/services/oauthTokens.js

@@ -0,0 +1,164 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.wwwAuthenticate = exports.protectedResourceMetadata = exports.resourceMetadataUrlOf = exports.defaultResourceMetadataUrl = exports.oauthGrantId = exports.looksLikeOAuthAccessToken = exports.permissionsForOAuthScopes = exports.OAUTH_SCOPE_PERMISSIONS = exports.OAUTH_SCOPES = void 0;
+exports.createOAuthTokenVerifier = createOAuthTokenVerifier;
+const crypto_1 = __importDefault(require("crypto"));
+// ── OAuth access tokens ──
+// An app the user signed in to with their account (e.g. claude.ai's connector) comes with an
+// OAuth access token: a JWT the authorization server signed (RS256) for one resource (its
+// audience, RFC 8707). It's checked with the server's published keys alone (JWKS): no secret
+// is shared. What it may do is what the user approved -- its scopes -- as permissions of the
+// API tokens' kind, so the same checks limit it; and, as a user's token, never more than the
+// user can (their role in each project still applies).
+exports.OAUTH_SCOPES = ['streamby:read', 'streamby:write'];
+const READ_PERMISSIONS = [
+    'project:read', 'members:read', 'assets:read', 'production:read', 'workflow:read',
+    'exports:read', 'rights:read', 'jobs:read',
+];
+// Making and changing, as the consent screen says: never deleting, nor managing members.
+const WRITE_PERMISSIONS = [
+    'project:update', 'assets:write', 'production:write', 'workflow:write', 'exports:write',
+    'rights:write', 'jobs:run', 'projects:create',
+];
+/** The permissions each scope grants. */
+exports.OAUTH_SCOPE_PERMISSIONS = {
+    'streamby:read': READ_PERMISSIONS,
+    'streamby:write': [...READ_PERMISSIONS, ...WRITE_PERMISSIONS],
+};
+/** What a token's scopes let it do (scopes that aren't StreamBy's grant nothing here). */
+const permissionsForOAuthScopes = (scopes) => [...new Set(scopes.flatMap(scope => exports.OAUTH_SCOPE_PERMISSIONS[scope] ?? []))];
+exports.permissionsForOAuthScopes = permissionsForOAuthScopes;
+const SKEW_SECONDS = 60;
+const REFETCH_MIN_MS = 60 * 1000;
+const decodePart = (part) => {
+    try {
+        const value = JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
+        return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+};
+/**
+ * Whether a bearer is shaped as an OAuth access token (a JWT signed with RS256), not whether
+ * it's valid: for an authProvider to tell it from its own session tokens.
+ */
+const looksLikeOAuthAccessToken = (token) => {
+    if (typeof token !== 'string')
+        return false;
+    const parts = token.split('.');
+    return parts.length === 3 && decodePart(parts[0])?.alg === 'RS256';
+};
+exports.looksLikeOAuthAccessToken = looksLikeOAuthAccessToken;
+/** The grant an OAuth request counts as (its rate limit's key): one app, for one user. */
+const oauthGrantId = (clientId, userId) => `oauth:${clientId}:${userId}`;
+exports.oauthGrantId = oauthGrantId;
+/**
+ * Checks OAuth access tokens: their signature with the issuer's keys, the issuer, that they're
+ * for StreamBy (their audience), and that they haven't expired. The verified token, or null.
+ * It doesn't know whether the user has since revoked the app: the host may check that too.
+ */
+function createOAuthTokenVerifier(options) {
+    const now = () => (options.now ? options.now() : Date.now());
+    const cacheMs = options.jwksCacheMs ?? 5 * 60 * 1000;
+    const fetcher = options.fetcher ?? fetch;
+    let keys = new Map();
+    let fetchedAt = -Infinity;
+    let inFlight = null;
+    const loadKeys = async () => {
+        const jwks = typeof options.jwks === 'function'
+            ? await options.jwks()
+            : await fetcher(options.jwks, { headers: { Accept: 'application/json' }, redirect: 'error', signal: AbortSignal.timeout(5000) })
+                .then(res => (res.ok ? res.json() : Promise.reject(new Error(`JWKS answered ${res.status}`))));
+        const next = new Map();
+        for (const jwk of jwks?.keys ?? []) {
+            if (jwk.kty !== 'RSA' || !jwk.kid || (jwk.alg && jwk.alg !== 'RS256') || (jwk.use && jwk.use !== 'sig'))
+                continue;
+            try {
+                next.set(jwk.kid, crypto_1.default.createPublicKey({ key: jwk, format: 'jwk' }));
+            }
+            catch { /* not a usable key */ }
+        }
+        keys = next;
+        fetchedAt = now();
+    };
+    const refresh = async () => {
+        inFlight ?? (inFlight = loadKeys().catch(err => {
+            fetchedAt = now(); // don't hammer a failing JWKS
+            console.error('❌ StreamBy OAuth: could not load the issuer\'s keys:', err instanceof Error ? err.message : err);
+        }).finally(() => { inFlight = null; }));
+        await inFlight;
+    };
+    const keyFor = async (kid) => {
+        if (now() - fetchedAt > cacheMs)
+            await refresh();
+        if (!keys.has(kid) && now() - fetchedAt > REFETCH_MIN_MS)
+            await refresh();
+        return keys.get(kid);
+    };
+    return async function verify(token) {
+        if (!(0, exports.looksLikeOAuthAccessToken)(token))
+            return null;
+        const [headerPart, payloadPart, signaturePart] = token.split('.');
+        const header = decodePart(headerPart);
+        const claims = decodePart(payloadPart);
+        if (!header || !claims || typeof header.kid !== 'string')
+            return null;
+        const key = await keyFor(header.kid);
+        if (!key)
+            return null;
+        const signed = crypto_1.default.verify('RSA-SHA256', Buffer.from(`${headerPart}.${payloadPart}`), key, Buffer.from(signaturePart, 'base64url'));
+        if (!signed)
+            return null;
+        const seconds = Math.floor(now() / 1000);
+        const audiences = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+        if (claims.iss !== options.issuer)
+            return null;
+        if (!audiences.some(aud => typeof aud === 'string' && options.audiences.includes(aud)))
+            return null;
+        if (typeof claims.exp !== 'number' || claims.exp + SKEW_SECONDS <= seconds)
+            return null;
+        if (typeof claims.nbf === 'number' && claims.nbf - SKEW_SECONDS > seconds)
+            return null;
+        if (typeof claims.sub !== 'string' || !claims.sub || typeof claims.client_id !== 'string' || !claims.client_id)
+            return null;
+        const scopes = typeof claims.scope === 'string' ? claims.scope.split(' ').filter(Boolean) : [];
+        return {
+            userId: claims.sub,
+            clientId: claims.client_id,
+            scopes,
+            expiresAt: new Date(claims.exp * 1000),
+            scope: {
+                tokenId: (0, exports.oauthGrantId)(claims.client_id, claims.sub),
+                kind: 'user',
+                permissions: (0, exports.permissionsForOAuthScopes)(scopes),
+                projectIds: '*',
+            },
+        };
+    };
+}
+// ── The protected resource's metadata (RFC 9728) ──
+/** Where RFC 9728 puts a resource's metadata: at its origin, before its path. */
+const defaultResourceMetadataUrl = (resource) => {
+    const url = new URL(resource);
+    const path = url.pathname === '/' ? '' : url.pathname.replace(/\/$/, '');
+    return `${url.origin}/.well-known/oauth-protected-resource${path}`;
+};
+exports.defaultResourceMetadataUrl = defaultResourceMetadataUrl;
+const resourceMetadataUrlOf = (oauth) => oauth.resourceMetadataUrl ?? (0, exports.defaultResourceMetadataUrl)(oauth.resource);
+exports.resourceMetadataUrlOf = resourceMetadataUrlOf;
+/** The metadata a client reads to know where to sign in, and what to ask for. */
+const protectedResourceMetadata = (oauth) => ({
+    resource: oauth.resource,
+    authorization_servers: [oauth.issuer],
+    scopes_supported: [...exports.OAUTH_SCOPES],
+    bearer_methods_supported: ['header'],
+    resource_name: oauth.resourceName ?? 'StreamBy',
+});
+exports.protectedResourceMetadata = protectedResourceMetadata;
+/** The WWW-Authenticate challenge of a 401: the metadata's URL, and why the token was refused. */
+const wwwAuthenticate = (oauth, invalidToken) => `Bearer resource_metadata="${(0, exports.resourceMetadataUrlOf)(oauth)}"${invalidToken ? ', error="invalid_token"' : ''}`;
+exports.wwwAuthenticate = wwwAuthenticate;

package/dist/services/vfxProcessor.js

@@ -13,7 +13,7 @@ function getNosqlDb() {
     return (0, connectionManager_1.getConnection)(ids[0]).client.db();
 }
 async function runRenderJob(jobId, fileId, projectId, options) {
-    (0, jobQueue_1.updateJob)(jobId, { status: 'processing', stage: 'resolving', progress: 10, assetId: fileId });
+    await (0, jobQueue_1.updateJob)(jobId, { status: 'processing', stage: 'resolving', progress: 10, assetId: fileId });
     try {
         const db = getNosqlDb();
         if (!db)
@@ -21,7 +21,7 @@ async function runRenderJob(jobId, fileId, projectId, options) {
         const fileDoc = await db.collection('storage_files').findOne({ fileId, projectId });
         if (!fileDoc)
             throw new Error(`File ${fileId} not found`);
-        (0, jobQueue_1.updateJob)(jobId, { stage: 'queued-farm', progress: 20 });
+        await (0, jobQueue_1.updateJob)(jobId, { stage: 'queued-farm', progress: 20 });
         // Store pending render task — picked up by the host render farm worker
         await db.collection('media_metadata').updateOne({ assetId: fileId, projectId }, {
             $set: {
@@ -40,14 +40,14 @@ async function runRenderJob(jobId, fileId, projectId, options) {
                 extractedAt: new Date(),
             },
         }, { upsert: true });
-        (0, jobQueue_1.updateJob)(jobId, { stage: 'pending-worker', progress: 30 });
+        await (0, jobQueue_1.updateJob)(jobId, { stage: 'pending-worker', progress: 30 });
     }
     catch (err) {
-        (0, jobQueue_1.failJob)(jobId, err.message);
+        await (0, jobQueue_1.failJob)(jobId, err.message);
     }
 }
 async function runFormatConvertJob(jobId, fileId, projectId, options) {
-    (0, jobQueue_1.updateJob)(jobId, { status: 'processing', stage: 'resolving', progress: 10, assetId: fileId });
+    await (0, jobQueue_1.updateJob)(jobId, { status: 'processing', stage: 'resolving', progress: 10, assetId: fileId });
     try {
         const db = getNosqlDb();
         if (!db)
@@ -55,7 +55,7 @@ async function runFormatConvertJob(jobId, fileId, projectId, options) {
         const fileDoc = await db.collection('storage_files').findOne({ fileId, projectId });
         if (!fileDoc)
             throw new Error(`File ${fileId} not found`);
-        (0, jobQueue_1.updateJob)(jobId, { stage: 'queued-convert', progress: 25 });
+        await (0, jobQueue_1.updateJob)(jobId, { stage: 'queued-convert', progress: 25 });
         await db.collection('media_metadata').updateOne({ assetId: fileId, projectId }, {
             $set: {
                 assetId: fileId,
@@ -71,14 +71,14 @@ async function runFormatConvertJob(jobId, fileId, projectId, options) {
                 extractedAt: new Date(),
             },
         }, { upsert: true });
-        (0, jobQueue_1.updateJob)(jobId, { stage: 'pending-worker', progress: 35 });
+        await (0, jobQueue_1.updateJob)(jobId, { stage: 'pending-worker', progress: 35 });
     }
     catch (err) {
-        (0, jobQueue_1.failJob)(jobId, err.message);
+        await (0, jobQueue_1.failJob)(jobId, err.message);
     }
 }
 async function runLodJob(jobId, fileId, projectId, options) {
-    (0, jobQueue_1.updateJob)(jobId, { status: 'processing', stage: 'resolving', progress: 10, assetId: fileId });
+    await (0, jobQueue_1.updateJob)(jobId, { status: 'processing', stage: 'resolving', progress: 10, assetId: fileId });
     try {
         const db = getNosqlDb();
         if (!db)
@@ -86,7 +86,7 @@ async function runLodJob(jobId, fileId, projectId, options) {
         const fileDoc = await db.collection('storage_files').findOne({ fileId, projectId });
         if (!fileDoc)
             throw new Error(`File ${fileId} not found`);
-        (0, jobQueue_1.updateJob)(jobId, { stage: 'queued-lod', progress: 25 });
+        await (0, jobQueue_1.updateJob)(jobId, { stage: 'queued-lod', progress: 25 });
         await db.collection('media_metadata').updateOne({ assetId: fileId, projectId }, {
             $set: {
                 assetId: fileId,
@@ -102,10 +102,10 @@ async function runLodJob(jobId, fileId, projectId, options) {
                 extractedAt: new Date(),
             },
         }, { upsert: true });
-        (0, jobQueue_1.updateJob)(jobId, { stage: 'pending-worker', progress: 30 });
+        await (0, jobQueue_1.updateJob)(jobId, { stage: 'pending-worker', progress: 30 });
     }
     catch (err) {
-        (0, jobQueue_1.failJob)(jobId, err.message);
+        await (0, jobQueue_1.failJob)(jobId, err.message);
     }
 }
 async function resolveAssetDependencyGraph(projectId, rootAssetId, maxDepth = 5) {

package/dist/services/workerJobs.d.ts

@@ -0,0 +1,73 @@
+import { Auth, JobRecord, StorageAdapter, StreamByConfig, WorkerRef, WorkerResultMode } from '../types';
+export declare const WORKER_CALLBACK_PATH = "/worker-jobs";
+type RouterConfig = StreamByConfig & {
+    adapter?: StorageAdapter;
+};
+export interface WorkerJobRequest {
+    assetId: unknown;
+    versionId?: unknown;
+    worker: unknown;
+    kind: unknown;
+    profile?: unknown;
+    resultMode?: unknown;
+}
+/** Asks a worker to process an asset, as `auth`: the job, pending, to be sent right away. */
+export declare function enqueueWorkerJob(project: any, request: WorkerJobRequest, auth: Auth, config: RouterConfig, callbackBase: string): Promise<JobRecord>;
+/** Runs the workers set to process, by themselves, an asset of their categories marked as a deliverable. */
+export declare function enqueueAutomaticJobs(project: any, assetId: string, versionId: string | null, auth: Auth, config: RouterConfig, callbackBase: string): Promise<JobRecord[]>;
+/** A failed worker job, back in line. */
+export declare function retryWorkerJob(jobId: string, config: RouterConfig): Promise<JobRecord | null>;
+/**
+ * Sends a pending job (or one its worker didn't finish in time) to its worker. Of several
+ * instances, only the one that claims it does.
+ */
+export declare function dispatchJob(jobId: string, config: RouterConfig): Promise<void>;
+/** Looks, now and then, for jobs to send (again). Every instance does; claiming keeps them from doubling. */
+export declare function startWorkerSweeper(config: RouterConfig): () => void;
+/** The job a callback is about, if its token is this attempt's and the job is in progress. */
+export declare function authorizeCallback(jobId: string, authorization: string | undefined): Promise<JobRecord>;
+export declare function reportProgress(job: JobRecord, body: any): Promise<JobRecord | null>;
+/** Where the worker uploads its result: a key of its own until the job completes. */
+export declare function resultUploadUrl(job: JobRecord, body: any, config: RouterConfig): Promise<{
+    url: string;
+    method: string;
+    headers: {
+        'Content-Type': any;
+    };
+    expiresAt: string;
+}>;
+/** The worker's result, kept: a new version of the asset, or a new asset derived from it. */
+export declare function completeJob(job: JobRecord, body: any, config: RouterConfig): Promise<JobRecord>;
+/** The worker couldn't do it: sent again if it says it may work later (and attempts are left), or failed. */
+export declare function failWorkerJob(job: JobRecord, body: any, config: RouterConfig): Promise<JobRecord | null>;
+/** What's shown of a job: never its callback token's hash, nor its upload's key. */
+export declare const publicJob: ({ callbackHash: _hash, upload: _upload, payload, ...job }: JobRecord) => {
+    payload: Record<string, any>;
+    jobId: string;
+    jobType: import("../types").JobType;
+    userId: string;
+    projectId: string;
+    assetId?: string;
+    status: import("../types").JobStatus;
+    stage: string;
+    progress: number;
+    error?: string;
+    createdAt: Date;
+    updatedAt: Date;
+    worker?: WorkerRef | null;
+    kind?: string | null;
+    profile?: Record<string, unknown> | null;
+    versionId?: string | null;
+    resultMode?: WorkerResultMode | null;
+    attempts?: number;
+    maxAttempts?: number;
+    nextAttemptAt?: Date | null;
+    leaseUntil?: Date | null;
+    report?: Record<string, unknown> | null;
+    result?: {
+        assetId: string;
+        versionId: string;
+        mode: WorkerResultMode;
+    } | null;
+};
+export {};